opencode: add oracle research tools, spec-planner question tool, deny mcp-auth read

profiles/opencode.nix

@@ -28,6 +28,7 @@
 					"*.env.*" = "deny";
 					"*.envrc" = "deny";
 					"secrets/*" = "deny";
+					"~/.local/share/opencode/mcp-auth.json" = "deny";
 				};
 			};
 			agent = {

profiles/opencode/agent/oracle.md

@@ -12,6 +12,10 @@ permission:
   grep: allow
   glob: allow
   webfetch: allow
+  opensrc_execute: allow
+  context7_resolve-library-id: allow
+  context7_query-docs: allow
+  grep_app_searchGitHub: allow
   lsp: allow
 ---
 
@@ -72,8 +76,12 @@ Brief outline only if relevant and trade-offs are significant.
 
 ## Tool Usage
 
-You have read-only access: read, grep, glob, LSP, webfetch.
-Use them freely to verify assumptions and gather context. Your extended thinking enables deep analysis - leverage it fully.
+You have read-only access: read, grep, glob, LSP, webfetch, opensrc, context7, grep_app.
+Use them freely to verify assumptions and gather context:
+- **opensrc**: Fetch and explore third-party package/repo source code
+- **context7**: Look up library documentation and API examples (resolve-library-id first, then query-docs)
+- **grep_app**: Search public GitHub repos for real-world usage patterns
+Your extended thinking enables deep analysis - leverage it fully.
 
 ## Guidelines
 

profiles/opencode/skill/spec-planner/SKILL.md

@@ -38,6 +38,23 @@ Phase: CLARIFY | Waiting for: answers to questions 1-4
 3. Ask 3-5 pointed questions that would change the approach. USE YOUR QUESTION TOOL. 
 4. **Wait for responses**
 
+**IMPORTANT: Always use the `question` tool to ask clarifying questions.** Do NOT output questions as freeform text. The question tool provides structured options and better UX. Example:
+
+```
+question({
+  questions: [{
+    header: "Scope",
+    question: "Which subsystems need detailed specs?",
+    options: [
+      { label: "VCS layer", description: "jj-lib + gix unified interface" },
+      { label: "Review workflow", description: "GitHub PR-style local review" },
+      { label: "Event system", description: "pub/sub + persistence" }
+    ],
+    multiple: true
+  }]
+})
+```
+
 | Category | Example |
 |----------|---------|
 | Scope | "Share where? Social media? Direct link? Embed?" |